r8.2 Unique identity and federated user lifecycle
Assign a unique identifier to each user and manage the identity lifecycle (creation, changes, removal) to ensure accountability for actions on system components.
AWS services
AWS IAM Identity Center 
AWS IAM 
AWS CloudTrail Requirement 8
Identify Users and Authenticate Access to System Components
PCI sub-requirements covered
- 8.2 User identification and related accounts are managed throughout their lifecycle
How to implement on AWS
Federate identities with the corporate IdP through IAM Identity Center; avoid shared accounts. Sync joiners/leavers with the IdP to promptly revoke access for departed personnel. Prohibit shared IAM users. Log all activity with CloudTrail attributed to the unique user.
Practical implementation
How this control is implemented in each reference architecture:
Federate identities through IAM Identity Center (no shared accounts), sync joiners/leavers with your IdP, and ensure CloudTrail attributes every action to a unique user in the account.
Single-account, 3-tier →One federated identity source (IAM Identity Center + IdP via SCIM) governs unique IDs across all accounts; deprovisioning removes access everywhere at once and unique attribution is preserved in the central CloudTrail.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Interview personnel and examine audit logs to verify each user has a unique ID and that access can be uniquely attributed to individuals (8.2.1.a, 8.2.1.b).
- Examine account lists and policies to verify shared authentication credentials are only used on an exception basis and managed accordingly (8.2.2.a, 8.2.2.b).
- Examine information sources for terminated users and access lists to verify terminated user IDs are deactivated or removed (8.2.5.a).
Evidence in AWS
- IdP federation configuration and absence of shared accounts.
- Provisioning/deprovisioning process (SCIM) and evidence of timely revocation.
- CloudTrail events attributable to unique identities.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 8.2 — All actions by all users are attributable to an individual.
Learning resources
References
- PCI DSS v4.0.1 Requirement 8.2